I am new to security and I was wondering if I can make my program better by changing or adding something to make it better/secure.

Should I use a keyGenerator? I have my doubts from my program output.


Encrypted Message: +g@þóv«5Ùû`ž   
keybyte: [B@71e7a66b   
Original string: Message   
Original string (Hex): [B@2ac1fdc4

public class AES {

public static void main(String ... args) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
    final String Algo="AES";
    String key = "aaaaaaaaaaaaaaaa";
    byte[] keyBytes = key.getBytes(StandardCharsets.UTF_8);

    MessageDigest sha= MessageDigest.getInstance("SHA-1"); 
    keyBytes=Arrays.copyOf(keyBytes, 16);

    SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, Algo);
    Cipher cipher = Cipher.getInstance(Algo);
    cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
    byte[] ciphertext = cipher.doFinal("Message".getBytes());
    System.out.println("Encrypted Message: " +new String(ciphertext));

    cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
    byte[] original = cipher.doFinal(ciphertext);
    String originalString = new String(original);
    System.out.println("keybyte: "+keyBytes);
    System.out.println("Original string: " + originalString + "\nOriginal string (Hex): " +original);

  • 1
    \$\begingroup\$ @ferada Your comment should be posted as an answer. \$\endgroup\$ Mar 29 '17 at 22:00

<Insert disclaimer about not using home-brew stuff for security if you don't understand it enough. Also, I'm not a security expert, I can/will only tell you what's obviously wrong, not if it was secure for sure. And I'm somewhat sorry this sounds harsh, but please just learn more in-depth about this topic, e.g. The Cryptopals Crypto Challenges are an awesome way to learn by doing in case you have no other resources at hand.>

With that out of the way, the code is not secure in any way shape or form. You have to assume that the attacker knows all of the code, including any hard-coded values. Otherwise you should indicate that they are example values and should be understood as input instead.

Let's assume now that the key is therefore input; running SHA-1 on it is okay, but won't make it any more secure. In practice you'd probably run a proper key derivation function on it in case you don't generate a random key anyway.

Then, reading the documentation (or alternatively looking at Stackoverflow) will tell you that the default settings for "AES" in this Java API is ECB mode (with PKCS#5 padding, but that doesn't matter) - which is insecure as the picture in that paragraph illustrates rather nicely. This also shows that you can't rely on these defaults because it's AFAIK not specified what they are going to be.

As an aside, keybyte: [B@71e7a66b shows some internal representation of the array, not the actual bytes (notice the [B@ pattern); e.g. look here for some ideas on that - in practice you'd be using a library of course.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.